ci: migrate the ejected CRA to Vite and Vitest on current Node and add a runtime gate, security scan, workflow lint and house Renovate preset

.github/runtime-gate.md

@@ -0,0 +1,14 @@
+# test: notes for the runtime explorer
+
+**What it is.** A Create React App 2 starter kept for reproducing bugs, now
+built with Vite. It renders a single page: a header with the spinning React
+logo and "Welcome to React", and a line of intro text. Bootstrap 3 (Sass),
+Font Awesome 4 and jQuery are bundled, and a service worker is registered
+in production builds.
+
+**Flows worth trying.**
+1. Load `/` and check that the header, logo and intro text render.
+2. Resize to phone width and check nothing overflows.
+3. Reload, so the service worker serves the page, and check it still renders.
+
+**No logins, forms or data.** There is nothing else to explore.

.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+# The repo's own test suite (Vitest + Testing Library), on the latest Current
+# Node from .nvmrc, via the shared node-ci workflow. There is no lint or
+# typecheck script, and the production build and the browser checks are in
+# runtime.yml, so only `npm test` runs here.
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    uses: rishitank/.github/.github/workflows/node-ci.yml@v1
+    with:
+      lint: ""
+      typecheck: ""
+      test: npm test
+      build: ""

.github/workflows/runtime.yml

@@ -0,0 +1,63 @@
+# Runtime gate: boots the app and uses it in a real browser before a change
+# (a Renovate update included) can merge. Fails on runtime errors: uncaught
+# exceptions, console errors, React hydration errors, failed same-origin
+# requests, 4xx/5xx, blank pages, crash screens. Advisory on top: screenshot
+# diff against the last master run, and an AI explorer (Gemini free
+# tier, GEMINI_API_KEY secret) that uses the app like a person for major or
+# framework updates, the `ai-explore` label, the weekly schedule and manual
+# runs. See docs/runtime-gate.md in rishitank/.github.
+name: runtime
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  schedule:
+    - cron: "43 5 * * 4"
+  workflow_dispatch:
+
+concurrency:
+  group: runtime-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  runtime:
+    name: runtime
+    uses: rishitank/.github/.github/workflows/runtime-gate.yml@f5b19aff6eac60563a34e7a2ddc057e75766235c
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+    with:
+      # Vite build on the latest Current Node (.nvmrc is `node`), installed
+      # with `npm ci` from package-lock.json.
+      mode: static
+      build: npm run build
+      static-dir: dist
+      # The generated service worker answers every navigation with
+      # index.html, so serve unknown paths the same way.
+      spa: true
+      port: 3000
+      # No sign-in: the app is the static CRA starter page with no accounts or
+      # login page, so login-path stays unset and there is one crawl.
+    secrets:
+      gemini-api-key: ${{ secrets.GEMINI_API_KEY }}
+
+  # Weekly/manual runs only: saves the paths the explorer completed to
+  # .github/runtime-gate-flows.json through a reviewed PR; the runtime job then
+  # replays them on every PR.
+  flows:
+    needs: runtime
+    if: ${{ !cancelled() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
+    uses: rishitank/.github/.github/workflows/runtime-gate-flows.yml@f5b19aff6eac60563a34e7a2ddc057e75766235c
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
+    with:
+      ci-workflows: |
+        runtime.yml
+        ci.yml

.github/workflows/security.yml

@@ -0,0 +1,26 @@
+# Vulnerable dependencies (osv-scanner), leaked secrets (gitleaks, full
+# history) and the ecosystem's own audit, via the shared workflow.
+name: security
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: "40 4 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    uses: rishitank/.github/.github/workflows/security.yml@v1
+    with:
+      ecosystem: node
+      # osv-scanner scans package-lock.json; the audit's setup-node reads
+      # .nvmrc (`node`, the latest Current release), the shared default.

.github/workflows/workflows-lint.yml

@@ -0,0 +1,18 @@
+# actionlint over this repo's workflows. Catches bad `uses:` refs, undefined
+# contexts and shell bugs in `run:` blocks before they cost a red build.
+name: workflows-lint
+
+on:
+  pull_request:
+    paths: [".github/workflows/**"]
+  push:
+    branches: [master]
+    paths: [".github/workflows/**"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    uses: rishitank/.github/.github/workflows/workflows-lint.yml@v1

.gitignore

@@ -8,6 +8,7 @@
 
 # production
 /build
+/dist
 
 # misc
 .DS_Store

.nvmrc

@@ -0,0 +1 @@
+node